LXC: `protocol: any` combined with a port lowers only TCP and UDP, narrowing deny rules
@dhoehna is already working on this.
Since Aug 22, 2026.
- Dominant language
- Rust
- Stars
- 1.3k
- Forks
- 79
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 117
Description
Raised on #983 by the review bot. Verified at source.
## What happens
`lower_port_selector` (`src/backends/lxc/common/src/network_iptables.rs:1589-1601`):
- `protocol: any` with no port produces `RuleMatch::AnyTraffic`, which appends no `-p` filter and correctly matches every protocol.
- `protocol: any` with a port produces exactly two matches, TCP and UDP.
The doc comment at `:1569-1570` gives the reason: `-p all` accepts no `--dport`. That is a true constraint of iptables, and the consequence was not carried through to the deny case.
Under `egress.default: allow`, a rule `egress.deny { protocol: any, port: 443 }` blocks TCP/443 and UDP/443 and leaves SCTP/443 — and any other port-bearing protocol — reachable. The GA contract defines `any` as matching all protocols, and LXC advertises full `EGRESS_RULES` support.
## Options
1. Expand `any` with a port into the full set of port-bearing protocols iptables can match.
2. Reject the `any` + port combination at validation time rather than narrowing it silently.
Either is defensible. Silently narrowing a deny is not.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.